How we score and decide

P0, patch now: on the exploited list, or a score of 80 or more.
P1, this week: 60 to 79.
P2, this month: 40 to 59.
P3, routine: below 40.

The priority score is a guide to patch order. It does not replace your own risk assessment.

Priority score (0 to 100)

Signal	Points
CVSS severity	up to 35
EPSS exploit likelihood (percentile)	up to 25
On the CISA exploited list (KEV)	25
Used in ransomware campaigns	5
Public exploit code (Exploit-DB, Metasploit, PoC)	5
CISA SSVC: exploitation active / proof of concept / automatable with total impact	5 / 3 / 3
Remotely exploitable, no login, no user action	5
Covered by three or more security sources	3
On your watchlist	5

Strong exploit signals lift a CVE to at least P1. A critical CVE (CVSS 9 or more) is never below P2.

Upgrade when a fixed version exists. A vendor-confirmed fix always wins.
Downgrade only when an older release is confirmed unaffected and the package is not a core system component. The page carries a risk warning.
Mitigate when neither is available: the vendor workaround, or limiting exposure.

See the data sources page for every feed and whether it was reachable in the last run.